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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re Application of: Nanjunda Swamy S. Examiner: Mai T. Tran 
Jamadagni 

Serial No. : 1 0/034,689 Group Art Unit: 2 1 29 

Filed: December 28, 2001 Docket: 1488.015US1 

For: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT 
CORRELATION IN A COMMUNICATION SYSTEM BY THE USE OF 
CONTEXTUAL FUZZY COGNITIVE MAPS 



APPEAL BRIEF UNDER 37 CFR § 41.37 



Mail Stop Appeal Brief- Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Sir: 

The Appeal Brief is presented in support of the Notice of Appeal to the Board of Patent 
Appeals and Interferences, filed on May 12, 2006, from the Final Rejection of claims 1-63 of the 
above-identified application, as set forth in the Final Office Action mailed on December 13, 
2005. 

The Commissioner of Patents and Trademarks is hereby authorized to charge Deposit 
Account No. 19-0743 in the amount of $500.00 which represents the requisite fee set forth in 37 
C.F.R. § 41.2(b)(2). The Appellants respectfully request consideration and reversal of the 
Examiner's rejections of pending claims. 
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1. REAL PARTY IN INTEREST 



The real party in interest of the above-captioned patent application is the assignee, 
SASKEN COMMUNICATION TECHNOLOGIES LIMITED. 
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2. RELATED APPEALS AND INTERFERENCES 



There are no other appeals or interferences known to Appellant that will have a bearing 
on the Board's decision in the present appeal. 
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3. STATUS OF THE CLAIMS 

The present application was filed on December 3 1 , 2002 with claims 1 -63 . A non-final 
Office Action mailed April 22, 2005, rejected all the claims. In response filed on October 24, 
2005, claims 10, 27, 30, 37, 46, 50 and 58 were amended. A Final Office Action (hereinafter 
"the Final Office Action") was mailed December 13, 2005. Claims 1 and 22 were amended in a 
response dated February 13, 2006, however, the amendment was not entered. Claims 1-63 stand 
twice rejected, remain pending, and are the subject of the present Appeal. 
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4. STATUS OF AMENDMENTS 

Claims 1 and 22 were amended in a response dated February 13, 2006, however, the 
amendment was not entered. Thus, no amendments have been made subsequent to the Final 
Office Action dated December 13, 2005. 
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5. SUMMARY OF CLAIMED SUBJECT MATTER 

Some aspects of the present inventive subject matter include, but are not limited to, 
systems and methods for diagnosing problems from multiple events that may be monitored. It 
can be very difficult in prior networks to identify a root problem because the problem may 
generate events in many different related parts of the system. These events may be going off in 
lots of different areas, making it difficult to identify the source of the real problem. In 
independent claim 1, a method diagnoses a problem from multiple events in a system of 
managed components (110, 800) which are generating real-time events (FIG. 9) of problems. 
Fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments (166, 1530) are 
formed using network element interdependencies derived from a database (160) defining the 
network managed objects (162) and event notifications that convey the state of one or more 
managed objects. Generated incoming real-time events (FIG. 9) are sampled (130 - see page 9, 
line 25 et seq., 1540) from the system. Problems are diagnosed (140 - see page 10, line 7 et seq., 
1570) by mapping the sampled events to the formed FCM fragments (140 - see page 10, line 15 
etseq., 1550). 

In some embodiments, the FCM fragments are formed by determining event nodes (1510 
- see pages 28-30) from events in the database, identifying concept nodes (1520) from the 
determined event nodes, and forming FCM fragments (1530) including interdependencies 
between the concept and event nodes using the determined event nodes and the identified 
concept nodes. Diagnosing the sampled events (1540) involves mapping the sampled real-time 
events to the formed FCM fragments (1550) including determined event nodes to evaluate the 
effect of the mapped event nodes on the identified concept nodes using the determined 
interdependencies, identifying the problems (1560) by analyzing the concept nodes based on the 
outcome of the evaluation, and diagnosing the problems (1570) based on the outcome of the 
analysis. Significant detail regarding formation and use of FCMs can be found beginning at line 
22 on page 1 1 of the application. Many of such details are claimed in dependent claims. 
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Independent claim 22 describes a method for diagnosing problems from multiple events 
in a communication network including managed components generating real-time events of 
problems. References to Figures and the specification are the same as for claim 1. Fuzzy 
cognitive maps (FCMs) are also formed in this method, including causally equivalent FCM 
fragments using network element interdependencies. Generated incoming real-time events from 
the network are also sampled. The method diagnoses each of the generated problems by 
mapping the received sampled events to the formed FCM fragments. 

Independent claim 25 is a computer readable medium version of claim 1 and describes a 
computer implemented method that diagnoses a problem from multiple events in a system of 
managed components (110, 800) which are generating real-time events (FIG. 9) of problems. 
Fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments (166, 1530) are 
formed using network element interdependencies derived from a database (160) defining the 
network managed objects (162) and event notifications that convey the state of one or more 
managed objects. Generated incoming real-time events (FIG. 9) are sampled (130 - see page 9, 
line 25 et seq., 1540) from the system. Problems are diagnosed (140 - see page 10, line 7 et seq., 
1570) by mapping the sampled events to the formed FCM fragments (140 - see page 10, line 15 
etseq., 1550). 

Independent claim 33 is a computer system that diagnoses problems from multiple events 
in a system of managed components generating real-time events of problems. Shown at least in 
FIGS. 1 (pages 8-11), 8 (pages 18-19) and 16 (pages 30-31), the system includes a storage device 
(160, 1612, 1614), an output device (150, 1618), and a processor (1602) programmed to 
repeatedly perform a method similar to that of claim 1 . 

Independent claim 41 (see FIG. 1, pages 8-11) describes an event-correlation system 
(100) to diagnose problems from multiple incoming real-time events in a communication 
network (110) of managed components generating real-time events of problems (130). An 
event-analyzer (140) forms fuzzy cognitive map (FCM) fragments (166) using network element 
interdependencies derived from a database (160) defining the network managed objects (162) 
and event notifications that convey the state of one or more managed objects. An event- 
processing module (130) is coupled to the event-analyzer and samples generated incoming real- 
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time events from the network. The analyzer diagnoses the problems from the sampled events by 
mapping the sampled events to the formed FCM fragments. 

This summary does not provide an exhaustive or exclusive view of the present subject 
matter, and Appellant refers to the appended claims and its legal equivalents for a complete 
statement of the invention. 
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6. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Claims 1-18, 22-31, 33-39, 41-58, and 62-63 were rejected under 35 U.S.C. § 102(b) for 
anticipation by Ndousse et al., "Computational Intelligence for Distributed Fault Management in 
Networks Using Fuzzy Cognitive Maps". 

Claims 19-21, 32, 40, and 59-61 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Ndousse as applied to claims 1-18, 22-31, 33-39, 41-58, and 62-63 above, in 
view of Zhi-Qiang Liu et al., "Contextual Fuzzy Cognitive Map for Decision Support in 
Geographic Information Systems", and further in view of Thierry Marchant, "Cognitive Maps 
and Fuzzy Implications." 
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7. ARGUMENT 

A. Summary of Arguments 

Appellant respectfully submits that the pending claims are in allowable form for various 
reasons as detailed in the arguments below. In particular, Appellant asserts that the references do 
not teach, disclose or suggest sampling of incoming real time events as recited in each 
independent claim. Several of the independent claims also recite utilization of a computer to 
form the fuzzy cognitive maps (FCMs), which is not shown in the references. 

B) The Applicable Law 

1. 35 U.S.C. §102(b) 

A claim is anticipated only if each and every element as set forth in the claim is found, 
either expressly or inherently described, in a single prior art reference. M.P.E.P § 2131. To 
anticipate a claim, a reference must disclose every element of the challenged claim and enable 
one skilled in the art to make the anticipating subject matter. PPG Industries, Inc. V. Guardian 
Industries Corp., 75 F.3d 1558, 37 USPQ2d 1618 (Fed. Cir. 1996). The identical invention must 
be shown in as complete detail as is contained in the claim. Richardson v. Suzuki Motor Co., 868 
F.2d 1226, 1236, 9 USPQ2d 1913, 1920 (Fed. Cir. 1989). 

2. 35 U.S. C. § 103(a) 

In rejecting claims under 35 U.S.C. § 103, the Examiner bears the initial burden of 
establishing a prima facie case of obviousness. In re Oetiker, 977 F.2d 1443, 1445, 24 USPQ 
1443, 1444 (Fed. Cir. 1992). See also In re Piasecki, 745 F.2d 1468, 1472, 223 USPQ 785, 788 
(Fed. Cir. 1984). The Examiner can satisfy this burden by showing that some objective teaching 
in the prior art or knowledge generally available to one of ordinary skill in the art suggests the 
claimed subject matter. In re Fine, 837 F.2d 1071, 1074, 5 USPQ2d 1596, 1598 (Fed. Cir. 
1988). Only if this initial burden is met does the burden of coming forward with evidence or 
argument shift to the Appellants. Oetiker, 977 F.2d at 1445, 24 USPQ at 1444. See also 
Piasecki, 745 F.2d at 1472, 223 USPQ at 788. 
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When determining obviousness, "the [E]xaminer can satisfy the burden of showing 
obviousness of the combination 'only by showing some objective teaching in the prior art or 
individual to combine the relevant teachings of the references". In re Lee, 277 F.3d 1338, 1343, 
61 USPQ2d 1430, 1434 (Fed. Cir. 2002), citing In re Fritch, 972 F.2d 1260, 1265, 23 USPQ2d 
1780, 1783 (Fed. Cir. 1992). "Broad conclusory statements regarding the teaching of multiple 
references, standing alone, are not 'evidence.'" In re Dembiczak, 175 F.3d 994, 999, 50 
USPQ2d 1614, 1617. "Mere denials and conclusory statements, however, are not sufficient to 
establish a genuine issue of material fact." Dembiczak, 175 F.3d at 999, 50 USPQ2d at 1617, 
citing McElmurry v. Arkansas Power & Light Co., 995 F.2d 1576, 1578, 27 USPQ2d 1129, 1131 
(Fed. Cir. 1993). 

The Federal Circuit states that, "[t]he mere fact that the prior art may be modified in the 
manner suggested by the Examiner does not make the modification obvious unless the prior art 
suggested the desirability of the modification." In re Fritch, 972 F.2d 1260, 1266 n.14, 23 
USPQ2d 1780, 1783-83 n.14 (Fed. Cir. 1992), citing In re Gordon, 733 F.2d 900, 902, 221 
USEQ 1 125, 1 127 (Fed. Cir. 1984). In addition, the court stated in In re Lee, 277 F.3d 1338, 
1343, 61 USPQ2d 1430, 1433 (Fed. Cir. 2002), that when making an obviousness rejection 
based on combination, "there must be some motivation, suggestion or teaching of the desirability 
of making the specific combination that was made by Appellants" (quoting In re Dance, 160 
F.3d 1339, 1343, 48 USPQ2d 1635, 1637 (Fed. Cir. 1998). 

C) Discussion of the rejection of claim 1 under 35 U.S.C. § 102(b) as being anticipated by 
Ndousse et al, "Computational Intelligence for Distributed Fault Management in Networks 
Using Fuzzy Cognitive Maps". 

Claims 1-18, 22-31, 33-39, 41-58, and 62-63 were rejected under 35 U.S.C. § 102(b) for 
anticipation by Ndousse et al., "Computational Intelligence for Distributed Fault Management in 
Networks Using Fuzzy Cognitive Maps". There is clear error in the rejection, as independent 
claims 1, 25, 33, includes "sampling generated incoming real-time events from the system.", and 
Ndousse et al., does not describe such element. Independent claim 41 also includes "sample 
generated incoming real-time events from the network". Since an element of each of the 
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independent claims is lacking from the reference, a proper prima facie case of anticipation has 
not been established, and the rejection should be withdrawn. 

Independent claims 1, 25 and 33 recites "sampling generated incoming real-time events 
from the system." Independent claim 41 also samples generated incoming real time events. No 
mention of such sampling is found in the reference. The Office Action points to page 1558, left 
col., lines 5-8 of Ndousse et al., as describing this element. Such langauge, if referring to the 
abstract, indicates that "The dynamic features of FCM are exploited to characterize the time- 
varying aspects of network faults, while its graphical features are used as a framework for 
representing the distributed properties of fault propagation." No mention of sampling is found in 
this language. If the reference is to the Introduction, that recites: "Its essential features provide a 
rapid and intelligent solution to the following critical issues. - Diagnosis and location of the 
faulty components of the network." This language also fails to describe sampling. Since at least 
one element has not been properly shown to be in the reference, a proper prima facie case of 
anticipation has not been established, and the rejection should be reversed. 

The claims also utilize a computer to form the fuzzy cognitive maps, expressly in claims 
25 and 33, and by implication in claims 1 and 41, since they sample system generated real-time 
events and map the sampled events to diagnose problems. This would simply be impossible to 
do in real time by an expert, or within a time frame acceptable for diagnosing problems. In 
Ndousse et al„ FCMs are constructed by experts, not by a computer. This is illustrated by the 
fact that no computer implemented methodology for creating FCMs is disclosed, the fact that 
FIG.s 4 and 5 illustrated FCMs formed by two experts, and the text in the second column of page 
1560, beginning at the heading "IV. Aggregation FCM" recites that the causal viewpoint of each 
expert leads to an FCM with different causal weights. As such, the claims clearly distinguish 
from Ndousse et al., and the rejection should be withdrawn. 

Additionally, claim 1 recites forming fuzzy cognitive maps (FCMs) including causally 
equivalent FCM fragments using network element interdependencies derived from a database. 
The corresponding text describing this element is found in the application at least on page 8 with 
reference to event analyzer 140. 
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Claims 1, 25 and 33 also distinguish from Ndousse et al., in that the FCM fragments are 
formed. The Office Action cites page 1559, left col., lines 36-37 of Ndousse et al., as describing 
this feature. However, that language does not appear to describe the creation of the FCM 
fragments, but merely describes that "the FCM denote faulty managed objects or concepts, while 
the arcs denote fault propagation between managed objects or network fault concepts." This is 
clearly not describing how to create an FCM fragment, but only what it represents. Claims 1, 25 
and 33 describe how to create one using computer elements. Still further, no mention in Ndousse 
et al., was found regarding the use of event notifications that convey the state of one or more 
managed objects to create FCM fragments as claimed. 

Several claims are now individually discussed. The claims that are not expressly 
discussed depend from claims that are believed allowable at least on the same basis as the claims 
from which they depend. 



Claim 1 

Claim 1 distinguishes Ndousse et al., in at least two respects, either of which is sufficient 
to reverse the rejection. First, claim 1 clearly indicates that incoming real-time events from the 
system are sampled, and the sampled events are used to form the FCM fragments. Second, the 
FCM fragments are constructed by a computer in claim 1 at least by implication. Ndousse et al. 
does not describe either limitation. 

The Examiner points to page 1558, left col., lines 5-8 of Ndousse et al., as describing the 
element of claim 1 that includes sampling. This reference to lines of Ndousse et al., is the only 
analysis provided by the Examiner. There is nothing to indicate how such language describes 
sampling. As such, the rejection lacks specificity, and the rejection should be reversed. Such 
langauge of Ndousse et al, if referring to the abstract, indicates that "The dynamic features of 
FCM are exploited to characterize the time-varying aspects of network faults, while its graphical 
features are used as a framework for representing the distributed properties of fault propagation." 
No mention of sampling is found in this language. If the reference is to the Introduction, that 
recites: "Its essential features provide a rapid and intelligent solution to the following critical 
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issues. - Diagnosis and location of the faulty components of the network." This language fails to 
describe sampling, and a review of Ndousse et al., reveals no mention of sampling. Still further, 
no mention of events is found. Since at least one element has not been properly shown to be in 
the reference, a proper prima facie case of anticipation has not been established, and the rejection 
should be reversed. 

Ndousse et al., while introducing the concept of using FCMs to diagnose network faults, 
clearly describes that the FCMs are constructed by experts, not by a computer. This is illustrated 
by the fact that no computer implemented methodology for creating FCMs is disclosed, the fact 
that FIGS. 4 and 5 illustrated FCMs formed by two experts, and the text in the second column of 
page 1560, beginning at the heading 'TV. Aggregation FCM" recites that the causal viewpoint of 
each expert leads to an FCM with different causal weights. 

Claim 1 describes generating FCM fragments, implicating use of a computer to do so. 
Specifically, claim 1 recites forming fuzzy cognitive maps (FCMs) including causally equivalent 
FCM fragments using network element interdependencies derived from a database. The 
corresponding text describing this element is found in the application at least on page 8 with 
reference to event analyzer 140. 

Thus, claim 1 clearly distinguishes from Ndousse et al., in that the FCMs are computer 
generated. The Office Action cites page 1559, left col., lines 36-37 of Ndousse et al., as 
describing this feature. However, that language does not appear to describe the creation of the 
FCM fragments, but merely describes that "the FCM denote faulty managed objects or concepts, 
while the arcs denote fault propagation between managed objects or network fault concepts." 
This is clearly not describing how to create an FCM, but only what it represents. Claim 1 
describes how to create one. Still further, no mention in Ndousse et al, was found regarding the 
use of event notifications that convey the state of one or more managed objects to create FCM 
fragments as claimed. 



Claim 2 

Claim 2 depends from claim 1 and recites determining event nodes and concept nodes 
from determined event nodes. The FCM fragments, including interdependencies between the 
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concept and event nodes are formed using the determined event nodes and the concept nodes. 
Ndousse et al., in the portions cited by the Examiner: page 1559, left col., lines 41-42 describe 
the nodes as being representative of objects and concepts, not events and concepts as claimed. 
The cited language describes edges joining objects, and then indicates that the causal strength is 
based on the knowledge of network experts. This actually confirms the premise that the FCM in 
Ndousse et al., is created by an expert, not by a computer system as claimed. Further, the 
language describes the content of an FCM, not how it is made as claimed. While including 
concept nodes, it lacks a description of identifying concept nodes from the event nodes as 
claimed. Thus, Ndousse et al., functions entirely different from the operation of claim 2. The 
Examiner also points to page 1560 and the paragraph under Figure 5. This paragraph further 
recites that concept nodes represent network managed objects. Again, this is different than the 
event nodes of claim 2. While Ndousse et al., mentions faults, such faults are not equated to 
events, and further no "fault nodes" appear to be formed. As the reference lacks at least one 
element of claim 2, the rejection should be reversed. 



Claim 3 

Claim 3 depends from claim 2 and distinguishes the reference for at least the same 
reasons. Further, claim 3 recites mapping sampled real-time events to the formed FCM 
fragments. The Examiner indicates this is disclosed in Figure 2 on page 1559. However, Figure 
2 illustrates fault propagation using managed object nodes, and not events. Events, as claimed, 
do not appear to play a role in the FCM fragments of Ndousse et al., and the rejection should be 
reversed. 



Claim 11 

Claim 1 1 depends from claim 3 and distinguishes the references for at least the same 
reasons. Further, claim 1 1 recites that the incoming events are sampled sequentially in the order 
they are received. The Examiner references page 1558, left col., lines 5-8 of Ndousse et al., as 
describing this element. However, the cited text merely refers to time- varying aspects, and no 
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mention of events, real-time events, or sampling is found in Ndousse et al. The rejection should 
be reversed. 



Claim 12 

Claim 12 depends from claim 3 and distinguishes the references for at least the same 
reasons. Further, claim 12 recites identifying a composite set of events that capture the notion of 
an abstract exception condition in the network. The Examiner cites Figure 5 on page 1560 as 
describing this element. However, Figure 5 refers to the aggregation of FCMs from multiple 
experts. It is not seen how it is representative of a composite set of events as claimed. 



Claim 22 

Claim 22 distinguishes Ndousse et al., in that it clearly indicates that incoming real-time 
events from the system are sampled, and the sampled events are used to form the FCM 
fragments. 

The Examiner points to page 1558, left col., lines 5-8 of Ndousse et al., as describing the 
element of claim 1 that includes sampling. This reference to lines of Ndousse et al., is the only 
analysis provided by the Examiner. There is nothing to indicate how such language describes 
sampling. As such, the rejection lacks specificity, and the rejection should be reversed. Such 
langauge of Ndousse et al., if referring to the abstract, indicates that "The dynamic features of 
FCM are exploited to characterize the time-varying aspects of network faults, while its graphical 
features are used as a framework for representing the distributed properties of fault propagation." 
No mention of sampling is found in this language. If the reference is to the Introduction, that 
recites: "Its essential features provide a rapid and intelligent solution to the following critical 
issues. - Diagnosis and location of the faulty components of the network." This language fails to 
describe sampling, and a review of Ndousse et al., reveals no mention of sampling. Still further, 
no mention of events is found. Since at least one element has not been properly shown to be in 
the reference, a proper prima facie case of anticipation has not been established, and the rejection 
should be reversed. 
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Claim 23 

Claim 23 depends from claim 22 and recites determining event nodes and concept nodes 
from determined event nodes. The FCM fragments, including interdependences between the 
concept and event nodes are formed using the determined event nodes and the concept nodes. 
Ndousse et al., in the portions cited by the Examiner: page 1559, left col., lines 41-42 describe 
the nodes as being representative of objects and concepts, not events and concepts as claimed. 
Thus, Ndousse et al., functions entirely different from the operation of claim 23. The Examiner 
also points to page 1560 and the paragraph under Figure 5. This paragraph further recites that 
concept nodes represent network managed objects. Again, this is different than the event nodes 
of claim 23. As the reference lacks at least one element of claim 23, the rejection should be 
reversed. 



Claim 25 

Claim 25 is a computer readable medium version of claim 1, and is believed allowable 
for at least the same reasons. 



Claim 33 

Claim 33 is an independent claim that recites the use of a computer system to diagnose 
problems from multiple events. It is believed to distinguish the reference in a manner similar to 
that described with respect to claim 1, as sampling of incoming real-time events is performed. 
Ndousse et al., does not describe sampling, nor real-time events as a basis for diagnosing 
problems as claimed. Further, Ndousse et al., uses real experts and aggregates the FCMs of the 
experts. It does not describe use of a computer to generate FCMs, but instead such FCMs are 
generated by the experts themselves. Thus, claim 33 distinguishes from Ndousse et al., on many 
levels, and the rejection should be reversed. 



Claim 41 

Claim 41 is an independent claim that recites a system to diagnose problems from 
multiple events. It is believed to distinguish the reference in a manner similar to that described 
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with respect to claim 1, as sampling of incoming real-time events is performed. Ndousse et al., 
does not describe sampling, nor real-time events as a basis for diagnosing problems as claimed. 
Further, Ndousse et al, uses real experts and aggregates the FCMs of the experts. It does not 
describe use of a system to generate FCMs, but instead such FCMs are generated by the experts 
themselves. Thus, claim 41 distinguishes from Ndousse et al, on many levels, and the rejection 
should be reversed. 



Claim 42 

Claim 42 depends from claim 41 and recites determining event nodes and concept nodes 
from determined event nodes. The FCM fragments, including interdependencies between the 
concept and event nodes are formed using the determined event nodes and the concept nodes. 
Ndousse et al., in the portions cited by the Examiner: page 1559, left col., lines 41-42 describe 
the nodes as being representative of objects and concepts, not events and concepts as claimed. 
Thus, Ndousse et al., functions entirely different from the operation of claim 42. The Examiner 
also points to page 1560 and the paragraph under Figure 5. This paragraph further recites that 
concept nodes represent network managed objects. Again, this is different than the event nodes 
of claim 42. As the reference lacks at least one element of claim 42, the rejection should be 
reversed. 



Claim 43 

Claim 43 depends from claim 42 and distinguishes the reference for at least the same 
reasons. Further, claim 43 recites mapping sampled real-time events to the formed FCM 
fragments. The Examiner indicates this is disclosed in Figure 2 on page 1559. However, Figure 
2 illustrates fault propagation using managed object nodes, and not events. Events, as claimed, 
do not appear to play a role in the FCM fragments of Ndousse et al., and the rejection should be 
reversed. 



D) Discussion of the rejection of claims 19-21, 32, 40, and 59-61 under 35 U.S.C. § 103(a) as 
being unpatentable over Ndousse as applied to claims 1-18, 22-31, 33-39, 41-58, and 62-63 



APPEAL BRIEF UNDER 37 C.F.R. § 41.37 

Serial Number: 10/034,689 
Filing Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE 
THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 



Page 19 

Dkt: 1488.015US1 

EVENT CORRELATION IN A COMMUNICATION SYSTEM BY 



above, in view ofZhi-Qiang Liu et al, "Contextual Fuzzy Cognitive Map for Decision Support 
in Geographic Information Systems", and further in view of Thierry Marchant, "Cognitive 
Maps and Fuzzy Implications. " 

Claims 19-21, 32, 40, and 59-61 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Ndousse as applied to claims 1-18, 22-31, 33-39, 41-58, and 62-63 above, in 
view of Zhi-Qiang Liu et al., "Contextual Fuzzy Cognitive Map for Decision Support in 
Geographic Information Systems", and further in view of Thierry Marchant, "Cognitive Maps 
and Fuzzy Implications." Appellants respectfully traverse the rejection of these claims because 
a proper prima facie showing of obviousness has not been made. The combination of the 
references do not teach or suggest the invention as claimed, and the references are not 
combinable, as there is no proper motivation to combine them. 

Claim 19 

Claim 19 depends from claim 3 and is believed allowable for at least the same reasons. 
Further, claim 19 recites evaluating the effect of the received event nodes on the concept nodes. 
The references, alone or combined do not recite the use of event nodes in a method to diagnose 
problems in a system of managed components. The Examiner indicates that Liu teaches the 
computation of an indirect effect of concepts in an FCM using the claimed equation. Even if that 
were the case, it does not provide the missing use of event nodes of the present claim. Marchant 
is not cited as teaching, disclosing or suggesting the use of event nodes either. Thus, there is no 
teaching or suggestion of the use of event nodes, and the rejection should be reversed. 

Claims 20 and 21 

Claims 20 and 21 depend from claim 19. They describe the use of real time events to 
evaluate the effect of the received events on identified concept nodes. This is a form of 
dynamically changing the FCM fragments with time and the discovery of new concepts and 
events. This concept is not disclosed in Ndousse et al., at the cited right column of page 1559. 
Since an expert is used in Ndousse et al. to create the FCM, it would require the expert to 
continuously monitor real time traffic and change the model on the fly. This is simply not taught 
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or suggested. Further, the other references are not recited as providing this element. Thus, a 
proper prima facie case of obviousness has not been established, and the rejection should be 
reversed. 



Claim 32 

Claim 32 depends from claim 27 and is believed allowable for at least the same reasons. 
Further, claim 32 is similar to claim 19 in that it recites evaluating the effect of the received 
event nodes on the concept nodes. The references, alone or combined do not recite the use of 
event nodes in a method to diagnose problems in a system of managed components. The 
Examiner indicates that Liu teaches the computation of an indirect effect of concepts in an FCM 
using the claimed equation. Even if that were the case, it does not provide the missing use of 
event nodes of the present claim. Marchant is not cited as teaching, disclosing or suggesting the 
use of event nodes either. Thus, there is no teaching or suggestion of the use of event nodes, and 
the rejection should be reversed. 



Claim 40 

Claim 40 depends from claim 35 and is believed allowable for at least the same reasons. 
Further, claim 40 is similar to claim 19 in that it recites evaluating the effect of the received 
event nodes on the concept nodes. The references, alone or combined do not recite the use of 
event nodes in a method to diagnose problems in a system of managed components. The 
Examiner indicates that Liu teaches the computation of an indirect effect of concepts in an FCM 
using the claimed equation. Even if that were the case, it does not provide the missing use of 
event nodes of the present claim. Marchant is not cited as teaching, disclosing or suggesting the 
use of event nodes either. Thus, there is no teaching or suggestion of the use of event nodes, and 
the rejection should be reversed. 



Claim 59 

Claim 59 depends from claim 43 and is believed allowable for at least the same reasons. 
Further, claim 59 is similar to claim 19 in that it recites evaluating the effect of the received 
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event nodes on the concept nodes. The references, alone or combined do not recite the use of 
event nodes in a method to diagnose problems in a system of managed components. The 
Examiner indicates that Liu teaches the computation of an indirect effect of concepts in an FCM 
using the claimed equation. Even if that were the case, it does not provide the missing use of 
event nodes of the present claim. Marchant is not cited as teaching, disclosing or suggesting the 
use of event nodes either. Thus, there is no teaching or suggestion of the use of event nodes, and 
the rejection should be reversed. 



Claims 60 and 61 

Claims 60 and 61 depend from claim 59 and are believed allowable for at least the same 
reasons. Further, they both reference evaluating the effect of received event nodes. No such 
teaching is found or suggested in any of the references, alone or combined. Thus, the rejection 
should be reversed. 



APPEAL BRIEF UNDER 37 C.F.R § 41.37 

Serial Number: 10/034,689 
Filing Date: December 28, 2001 



Page 22 

Dkt: 1488.015US1 



Filing Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT CORRELATION IN A COMMUNICATION SYSTEM BY 
THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 



8. SUMMARY 

It is respectfully submitted that the art cited does not render the claim anticipated or 
obvious and that the claims are patentable over the cited art. Reversal of the rejection and 
allowance of the pending claims is respectfully requested. 
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CLAIMS APPENDIX 

1 . (Rejected) A method to diagnose a problem from multiple events in a system of 
managed components generating real-time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

2. (Rejected) The method of claim 1, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

3. (Rejected) The method of claim 2, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

4. (Rejected) The method of claim 3, wherein the system comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 
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5. (Rejected) The method of claim 3, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

6. (Rejected) The method of claim 5, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 

7. (Rejected) The method of claim 6, wherein determining the event nodes comprises: 
determining the event nodes from a database defining the network managed objects and 

event notifications that convey the state of one or more managed objects. 

8. (Rejected) The method of claim 7, wherein determining the event nodes further 
comprises: 

determining the event nodes from expert knowledge of the network. 

9. (Rejected) The method of claim 8, wherein the managed objects comprise: 
objects selected from the group consisting of network objects, attached systems, and 

application objects. 

1 0. (Rejected) The method of claim 8, wherein the database comprises: 

static information associated with each class of managed or dynamic information that 
affects the causal propagation of events. 

1 1 . (Rej ected) The method of claim 3 , wherein sampling the incoming real-time events 
comprises: 

sampling the incoming real-time events sequentially in the order they are received. 



12. 



(Rejected) The method of claim 3, wherein identifying the concept nodes comprises: 
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identifying a composite set of events that capture the notion of an abstract exception 
condition in the network. 



13. (Rejected) The method of claim 12, wherein the abstract exception condition comprises: 
abstract exception conditions selected from the group consisting of a notion of fault and a 

notion of performance degradation, a network card in a communication system being faulty with 
the number of users being served by the communication system drastically reducing, and link 
between two routers going down leading to the use of alternate paths which lead to congestion 
and performance. 

14. (Rejected) The method of claim 12, wherein capturing the abstract exception condition 
comprises: 

capturing normal paths based on predetermined criteria on which the events have to be 
diagnosed. 

15. (Rejected) The method of claim 14, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

16. (Rejected) The method of claim 1, wherein forming the FCM, comprises: 
capturing system event interdependencies. 

17. (Rejected) The method of claim 15, wherein capturing the system event 
interdependencies comprises: 

interconnecting event and concept nodes using interdependency arcs capturing temporal 
and logical dependencies. 



18. (Rejected) The method of claim 17, wherein the interdependency arcs comprise: 
weights based on temporal and logical dependencies. 
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19. (Rejected) The method of claim 3, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events (predictive event-correlation) on concept nodes 

using the equations: 

I px (E i: C ; ) = min( e (E, Cj)) = min( £p% ^ (E,, E k )) ® © min( e px (E ta , Cj)) 

wherein the indirect effect of events Ej on concept nodes Cj can be defined as the 

intersection of the linked causal types and can be described by the above equation, g px is a 

function which takes \ to [0,1] in path 'p' i.e. e^j = f -> \kj ), e {0,1}, and 8 represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

U (Ma (X) ' Mb = maX { °' Ma W + W ~ 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u A and 

u B - 

20. (Rejected) The method of claim 19, wherein mapping the received real-time events to 
the formed FCM fragments comprises: 

correlating the received events to the identified concept nodes to evaluate the effect of the 
received event nodes on the identified concept nodes using the determined element 
interdependencies. 

2 1 . (Rej ected) The method of claim 20, wherein correlating the received events to the 
concept nodes further comprises: 

accumulating evidence based on the received event nodes; 
comparing the accumulated evidence to a threshold value; and 

analyzing the concept nodes based on the outcome of the comparing to evaluate the effect 
of the received event nodes. 
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22. (Rejected) A method for diagnosing problems from multiple events in a communication 
network including managed components generating real-time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 

using network element interdependencies; 

sampling generated incoming real-time events from the network; and 

diagnosing each of the generated problems by mapping the received sampled events to 

the formed FCM fragments. 

23. (Rejected) The method of claim 22, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

24. (Rejected) The method of claim 23, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

25. (Rejected) A computer readable medium having computer-executable instructions to 
diagnose problems from multiple events in a system of managed components generating real- 
time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
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sampling generated incoming real-time events from the system; and 

diagnosing problems by mapping the sampled events to the formed FCM fragments. 

26. (Rejected) The computer readable medium of claim 25, wherein forming the FCM 
fragments comprises: 

determining event nodes from events in the database; 
identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

27. (Rejected) The computer readable medium of claim 26, wherein diagnosing the sampled 
events comprises: 

mapping the sampled real-time events to the formed FCM fragments including 
determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on activation levels of the 
concept nodes; and 

diagnosing the problems based on the outcome of the analysis. 

28. (Rej ected) The computer readable medium of claim 27, wherein the system comprises: 
a system selected from the group consisting of explicit system, implicit system, 

centralized system, partially centralized system, and distributed system. 

29. (Rejected) The computer readable medium of claim 28, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

30. (Rejected) The computer readable medium of claim 29, wherein the event nodes 
comprise: 
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significant events selected from the group consisting of hardware failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 

3 1 . (Rejected) The computer readable medium of claim 27, wherein identifying the concept 
nodes comprises: 

identifying a composite set of events that capture the notion of an abstract exception 
condition in the network. 

32. (Rejected) The computer readable medium of claim 27, wherein evaluating the effect of 
the received event nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 

I px (Ei, Q) = min( e (E;, Cj)) = min( 6p% (E b E0) © © min( g px Cj)) 

wherein the indirect effect of events Ei on concept nodes C, can be defined as the 
intersection of the linked causal types and can be described by the above equation, e is a 

function which takes ly to [0,1] in path 'p' i.e. e^ = f -> (I„, n y ), Hij e {0,1}, and 9 represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

t l (jU A (x), J U B (*)) = max {0, ju a (*) + JU B (*) - 1} 

wherein t x Q is a t-norm between fuzzy sets A and B with membership functions u A and 

33. (Rejected) A computer system to diagnose problems from multiple events in a system of 
managed components generating real-time events of problems, comprising: 

a storage device; 

an output device; and 



APPEAL BRIEF UNDER 37 C.F.R. § 41.37 Page 30 

Serial Number: 10/034,689 Dkt: 1488.015US1 

Filing Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT CORRELATION IN A COMMUNICATION SYSTEM BY 
THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 



a processor programmed to repeatedly perform a method, comprising: 
forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

34. (Rejected) The system of claim 33, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

35. (Rejected) The system of claim 34, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes evaluate the effect of the mapped event nodes on the identified concept 
nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

36. (Rejected) The system of claim 35, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

37. (Rejected) The system of claim 35, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 
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38. (Rejected) The system of claim 35, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 

condition in the network. 

39. (Rejected) The system of claim 35, wherein forming the FCM, comprises: 
capturing system event interdependencies by interconnecting event and concept nodes 

using interdependency arcs that capture temporal and logical dependencies. 

40. (Rejected) The system of claim 35, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 



wherein the indirect effect of events E, on concept nodes Cj can be defined as the 
intersection of the link causal types and can be described by the above equation, g is a 

function which takes Iy to [0,1] in path 'p' i.e. e Tij = f -> (Iy, mj )> e {0,1}, and © represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

U ( JU A {X) ' Mb = maX { °' Ma W + Mb W ~ 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u A and 

,u B - 



I px (Ei, CO = min( 6px (E, Cj)) = min( 6px ^ (E ; , E k )) 



emin(g (Efa.Cj)) 



41. (Rejected) An event-correlation system to diagnose problems from multiple incoming 
real-time events in a communication network of managed components generating real-time 
events of problems, comprising: 
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an event-analyzer to form fuzzy cognitive map (FCM) fragments using network element 
interdependencies derived from a database defining the network managed objects and event 
notifications that convey the state of one or more managed objects; and 

an event-processing module coupled to the event-analyzer to sample generated incoming 
real-time events from the network, wherein the analyzer to diagnose the problems from the 
sampled events by mapping the sampled events to the formed FCM fragments. 

42. (Rejected) The event-correlation system of claim 41, wherein the analyzer forms FCM 
fragments by determining event nodes from events in the database, and by further identifying 
concept nodes from the determined event nodes to form FCM fragments including 
interdependencies between the identified concept nodes and the determined event nodes. 

43. (Rejected) The event-correlation system of claim 41 , wherein the analyzer further maps 
the sampled events to the formed FCM fragments including determined event nodes to evaluate 
the effect of the mapped events on the determined concept nodes using the determined 
interdependencies, wherein the analyzer identifies the problems by analyzing the concept nodes 
based on the outcome of the evaluation and further diagnoses the problems based on the outcome 
of the analysis. 

44. (Rejected) The event-correlation system of claim 43, wherein the communication 
network comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 

45. (Rejected) The event-correlation system of claim 43, wherein the events comprise: 
exceptional conditions occurring during operation of the network. 



46. 



(Rejected) The event-correlation system of claim 45, wherein the event nodes comprise: 
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significant events selected from the group consisting of hardware failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 

47. (Rejected) The event-correlation system of claim 46, wherein the analyzer determines 
the event nodes from a database defining the network managed- objects and event notifications 
that convey the state of one or more managed objects. 

48. (Rejected) The event-correlation system of claim 47, wherein the analyzer determines 
the event nodes from expert knowledge of the network. 

49. (Rejected) The event-correlation system of claim 48, wherein the managed objects 
comprise: 

objects selected from the group consisting of network objects, attached systems, and 
application objects. 

50. (Rejected) The event-correlation system of claim 48, wherein the database comprises: 
static information associated with each class of managed objects or dynamic information 

that affects the causal propagation of events. 

5 1 . (Rejected) The event-correlation system of claim 43, further comprising: 

a communication interface module coupled between the network and the event- 
processing module to extract events from real-time messages received in different formats from 
the network and to further sample the extracted events sequentially in the order they are received. 

52. (Rejected) The event-correlation system of claim 43, wherein the analyzer identifying 
the concept nodes comprises a composite set of events that capture a notion of an abstract 
exception condition in the network. 
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53. (Rejected) The event-correlation system of claim 52, wherein the abstract exception 
condition comprises conditions selected from the group consisting of a notion of fault and a 
notion of performance degradation. 

54. (Rejected) The event-correlation system of claim 52, wherein the analyzer captures the 
abstract exception condition by capturing normal paths based on predetermined criteria from 
which for the events are diagnosed. 

55. (Rejected) The event-correlation system of claim 54, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

56. (Rejected) The event-correlation system of claim 43, wherein the analyzer forms FCM 
by capturing system event interdependencies. 

57. (Rejected) The event-correlation system of claim 56, wherein the analyzer captures 
system interdependencies by interconnecting event and concept nodes using interdependency 
arcs to capture temporal and logical dependencies. 

58. (Rejected) The event-correlation system of claim 57, wherein the interdependency arcs 
comprise: 

weights based on temporal and logical dependencies. 

59. (Rejected) The event-correlation system of claim 43, wherein the analyzer evaluates an 
indirect effect of events on concept nodes using the equations: 

UE, CO = min( e (E, Cj)) = min( 6px ^ (E,, E k )) © © min( (£*, Q)) 

wherein the indirect effect of events Ej on concept nodes Q can be defined as the 

intersection of the link causal types and can be described by the above equation, o is a 

P 

function which takes \ to [0,1] in path 'p' i.e. = f -> (Iy, \Mj ), e {0,1}, and © represents a 



THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 



concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

U ( Ma (XX Mb (X)) = m3X (0 ' Ma (x) + M B W " 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u A and 

ub- 

60. (Rejected) The event-correlation system of claim 59, wherein the analyzer maps the 
received real-time events to the formed FCM fragments by correlating the received events to the 
identified concept nodes to evaluate the effect of the received event nodes on the identified 
concept nodes using the determined element interdependencies. 

61 . (Rejected) The event-correlation system of claim 59, wherein the analyzer correlates the 
received events by accumulating evidence based on the received event nodes and compares the 
accumulated evidence to a threshold value, and analyzes the concept nodes based on the outcome 
of the comparing to evaluate the effect of the received event nodes. 

62. (Rejected) The event-correlation system of claim 43, further comprising: 

an interface output module coupled to the event-analyzer to output one or more solutions 
based on the outcome of diagnosing the problems by the analyzer. 

63. (Rejected) The event-correlation system of claim 62, further comprising: 
a memory to store the static and dynamic information. 
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EVIDENCE APPENDIX 



None. 
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RELATED PROCEEDINGS APPENDIX 



None. 



